CVE-2024-54160

dashboards-reporting (aka Dashboards Reports) before 2.19.0.0, as shipped in OpenSearch before 2.19, allows XSS because Markdown is not sanitized when previewing a header or footer.

CVSS v3.1

6.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

EPSS

0.59% chance of exploitation in the next 30 days, 46th percentile

Published

2025-02-12

Proof-of-concept exploits (1)

• Jflye/CVE-2024-54160-Opensearch-HTML-And-Injection-Stored-XSS0★ · 2025-02-13

References

• CVE Record
• NVD entry

Related

• CVE-2024-54152
• CVE-2024-5417
• CVE-2024-54151
• CVE-2024-5420
• CVE-2024-54148
• CVE-2024-5421